/owasp-api-top10

name: OWASP API Security Top 10
description: This skill should be used when the user asks about "API security", "OWASP API Top 10", "BOLA", "broken object level authorization", "API authentication", "mass assignment", "GraphQL security", "gRPC security", "rate limiting", "API abuse", "REST API vulnerabilities", or needs to identify API-specific security issues during whitebox security review.
version: 1.0.0

OWASP API Security Top 10 (2023) Reference

Purpose

Identify API-specific security vulnerabilities based on the OWASP API Security Top 10 (2023 edition), including REST, GraphQL, and gRPC patterns. APIs are the primary attack surface for modern applications, and these vulnerability classes represent the most critical and commonly exploited API security risks.

When to Use

Activate this skill when:

• Auditing REST API endpoints and route handlers
• Reviewing GraphQL schemas, resolvers, and configurations
• Assessing gRPC service definitions and interceptors
• Evaluating API authentication and authorization logic
• Testing rate limiting and resource consumption controls
• Reviewing API gateway configurations

API1:2023 - Broken Object Level Authorization (BOLA)

**Description**: API endpoints that accept object IDs and do not verify that the authenticated user has permission to access the referenced object.

**Pattern**: ID parameters used directly in database queries without ownership checks.

**Vulnerable Code Examples**:

Express.js:

// VULNERABLE: No ownership check
app.get('/api/orders/:id', auth, async (req, res) => {
  const order = await Order.findById(req.params.id);
  res.json(order); // Any authenticated user can access any order
});

Flask:

# VULNERABLE: No ownership check
@app.route('/api/orders/<int:order_id>')
@login_required
def get_order(order_id):
    order = Order.query.get_or_404(order_id)
    return jsonify(order.to_dict())  # Missing: order.user_id == current_user.id

Spring:

// VULNERABLE: No ownership check
@GetMapping("/api/orders/{id}")
public Order getOrder(@PathVariable Long id) {
    return orderRepository.findById(id)
        .orElseThrow(); // Any authenticated user can access any order
}

Go (net/http):

// VULNERABLE: No ownership check
func getOrder(w http.ResponseWriter, r *http.Request) {
    id := mux.Vars(r)["id"]
    order, _ := db.GetOrder(id) // Missing: order.UserID == authenticatedUser.ID
    json.NewEncoder(w).Encode(order)
}

**Detection Patterns**:

# Express: Route params used directly in DB queries
grep -rniE "req\.params\.\w+" --include="*.js" --include="*.ts" -A 5 | grep -iE "(findById|findOne|findByPk|where)"

# Flask: Route parameters in DB queries without ownership check
grep -rniE "def\s+\w+\(.*_id\)" --include="*.py" -A 10 | grep -iE "(query\.get|filter_by|find_one)"

# Spring: PathVariable in repository calls
grep -rniE "@PathVariable" --include="*.java" -A 5 | grep -iE "(findById|getOne|findOne)"

# Go: URL parameters in DB calls
grep -rniE "(mux\.Vars|chi\.URLParam|r\.URL\.Query)" --include="*.go" -A 5 | grep -iE "(GetOrder|FindBy|QueryRow)"

# Generic: Look for endpoints with ID params lacking authorization
grep -rniE "(/:id|/<int:|/{id}|\{id\})" --include="*.js" --include="*.ts" --include="*.py" --include="*.java" --include="*.go"

**Fix Pattern**: Always verify that the authenticated user owns or has permission to access the requested resource:

order = Order.query.get_or_404(order_id)
if order.user_id != current_user.id:
    abort(403)

API2:2023 - Broken Authentication

**Description**: Weak or missing authentication mechanisms on API endpoints.

**Vulnerable Patterns**:

| Pattern | Risk | Detection | |---------|------|-----------| | API key in URL query string | HIGH | `grep -rniE "api[_-]?key=.*[?&]" --include="*.js" --include="*.py"` | | No rate limiting on auth endpoints | HIGH | Check `/login`, `/auth`, `/token` for rate limit middleware | | JWT with `none` algorithm | CRITICAL | `grep -rniE "algorithm.*none\|alg.*none" --include="*.py" --include="*.js"` | | Missing token expiration | HIGH | `grep -rniE "expiresIn\|exp" --include="*.js" --include="*.py"` (check if absent) | | Hardcoded JWT secret | CRITICAL | `grep -rniE "(jwt_secret\|JWT_SECRET\|secret_key)\s*=\s*[\"']" --include="*.py" --include="*.js"` | | Password in API response | HIGH | Check serialization excludes password fields | | No authentication on sensitive endpoints | CRITICAL | Routes without `auth`, `authenticate`, `login_required` middleware |

**Per-Framework Detection**:

# Express: Routes without auth middleware
grep -rniE "app\.(get|post|put|delete|patch)\s*\(" --include="*.js" --include="*.ts" | grep -viE "(auth|protect|verify|middleware|passport)"

# Flask: Routes without login_required
grep -rniE "@app\.route" --include="*.py" -A 2 | grep -viE "(login_required|jwt_required|auth)"

# Spring: Endpoints without @PreAuthorize or security config
grep -rniE "@(Get|Post|Put|Delete)Mapping" --include="*.java" -B 3 | grep -viE "(PreAuthorize|Secured|RolesAllowed)"

# Go: Handlers without auth middleware in chain
grep -rniE "HandleFunc|Handle\(" --include="*.go" | grep -viE "(auth|middleware|protect)"

API3:2023 - Broken Object Property Level Authorization

**Description**: API exposes object properties that the user should not be able to read (excessive data exposure) or write (mass assignment).

**Excessive Data Exposure Patterns**:

# Returning entire ORM objects without field filtering
grep -rniE "\.to_dict\(\)|\.toJSON\(\)|jsonify\(\w+\)|res\.json\(\w+\)" --include="*.py" --include="*.js"

# Spring: Returning entity directly
grep -rniE "return\s+\w+Repository\.find" --include="*.java"

# Missing field selection in serialization
grep -rniE "JSON\.stringify\(user\)|json\.dumps\(\w+\.__dict__\)" --include="*.js" --include="*.py"

**Mass Assignment Patterns**:

# Express: Spreading request body into model
grep -rniE "\.c